Defending Internet Freedom through Decentralization: Back to the Future? [pdf] - <AUTHOR> http://dci.mit.edu/assets/papers/decentralized_web.pdf <comment><USER3> (From the document..)

Risks Posed by the Centralized Web

\- Facebook and Google, account for 81% of all incoming traffic to online news sources in the U.S.

\- Google processes 3.5 billion search queries per day, roughtly ten times more than its nearest competitors

Risk 1- Top-down, Direct Censorship

Risk 2 - Curational Bias/ Indirect Cencorship

Risk 3 - Abuse of Curatorial Power

Risk 4 - <USER2>

<comment><USER4> >Google processes 3.5 billion search queries per day, roughtly ten times more than its nearest competitors

The crazy thing to me is this has already been examined through many of their obviously anti-competitive acquisitions, and yet they always win. Namely, they use their position as the search engine leader to determine trends in search, purchases and advertising to buy companies in industries that will ultimately help the bottom line of their advertising revenue driven search engine to the detriment of alternative products.

In other words the very people/companies who already buy Google ads now must pay more for Google ads because Google entered the market and is competing for the same ads jacking up prices. Because of Google's search engine they know exactly where they can get away with this, they know the maximum ad cost bearable by their competitors and can/will squeeze it at best or they can effectively drive you out of business leaving themselves as the sole operator in the space at worst.

I mentioned it the other day, the one thing people could do is boycott google search, which I know sounds ridiculous, but how hard would it really be to organize a single day google search boycott across the web where people agreed to use bing or DuckDuckGo for a single day? google shareholders would throw a fit and change would be made internally in an instant, and I'd go so far as to say political pressure would come down to seriously look into the business practices. Most importantly people would wake up, understand their power and realize they own the web not these dominant corporate entities.

<comment><USER5> > how hard would it really be to organize a single day google search boycott > across the web

\- DDG and probably even Bing would go under.

\- It's just a slap on the wrist for Google.

I think a better idea is to create a distributed, federated crawler and search engine that does not depend on a central point of failure.

Alternatively, we could still use Google for long-tail, technical searches and use a different one for important queries such as politics and social.

<comment><USER6> Good luck creating a distributed search engine that produces results that come even close in quality to Google's. Search engines are hard. There is a reason Google dominates, and its not just inertia.

<comment><USER7> Don't take that advice as discouragement to start.

Google did have to engineer a giant distributed system to provide the search results we get. There are articles that talked about how they just had motherboards connected to hard drives laying on anti-static pads filling rooms in buildings. The racks and cabinets didn't make sense for them.

Today we take for granted software stacks like lucene. Nothing like that existed when Google moved into the space.

So yeah, 15-20 years ago internet search was a really difficult problem. Now, the sheer volume of research available which specifically addresses the problem space of a trusted decentralized search, to me, means that a solution is imminent.

You could be the person that puts all the research blocks in the right order and launches a successful project.

<comment><USER8> > giant distributed system

A politically distributed system is a whole different beast.

People have built plenty of distributed systems where all endpoints are under the control of a single organization (or cooperating organizations). That's essentially a solved problem.

But a system which is not under a single control is a whole different approach to being distributed. Not only does A not control B, they may not intend to cooperate, and A does not necessarily have any reason to trust B or vice versa. B may even be an endpoint that is outright hostile to the network itself (ie, spam, ddos).

There have been very few successful distributed systems that follow that model. The WWW is one. That's the good news: If you manage to find a viable model of decentralization, AND it succeeds in user adoption, you have literally changed the world forever.

That's how hard it is: People who achieve it go down in history.

<comment><USER7> I see it as more of an incremental process than as an achievement. The Gnutella2 protocol by Michael Stokes is the most successfully deployed emergent and distributed search service that I am aware of. While G2 lacks any trust mechanisms there are a few projects working in the problem space of trusted decentralized stacks or "anarchitecture" that are trying to solve that for us.[1][2][3] All the building blocks seem to be in some state of existence and there are people experimenting by arranging them differently. The systems trust example you gave seems easily solvable after creating a durable decentralized trust model which manages identities and can verify trust while keeping privacy in mind. User key management seems like it will always be a problem.

The thing you mentioned is user adoption. Even if a decentralized Google was available there is no marketing machine behind it. There's no reason for people to adopt it. Patchwork is a good example of what organic growth looks like for a decentralized social app.

Developers are another facet of user adoption. Developers don't think about using these tools for new service development. They get paid to work on centralized architectures. The incentives aren't there yet.

It makes sense to me that this is the natural evolution of that way in which we build services. And yeah, it is super hard and we are all gonna be famous. ;)

[1] [https://www.scuttlebutt.nz/](https://www.scuttlebutt.nz/)

[2] [http://ceptr.org/projects/holochain](http://ceptr.org/projects/holochain)

[3] [https://blockstack.org/](https://blockstack.org/)

<comment><USER9> > While G2 lacks any trust mechanisms there are a few projects working in the > problem space of trusted decentralized stacks

Search engines need to solve the spam issue.

Without central control you lack any solid ground for eradicating spam, preventing fake accounts, and exploits to your protocols. Building trust is not easy. The only progress we made in the past decade was with Bitcoin, proof-of-work. Bittorrent relies on either a central tracker or the DHT(==not very secure).

For the past 12 years I've dedicated my academic career to building trust without any central control or central servers. It's hard. <plug> We enhanced a Bittorrent client with a web-of-trust plus distributed torrent search and replaced tit-for-tat with a ledger. We using an incremental PageRank-like trust model. [https://github.com/Tribler/tribler/wiki#current-items- under-...](https://github.com/Tribler/tribler/wiki#current-items-under-active- development)

<comment><USER7> > Tribler is the first client which continuously tries to improve upon the > basic BitTorrent implementation by addressing some of the flaws. It > implements, amongst others, remote search, streaming, channels and > reputation-management. All these features are implemented in a completely > distributed manner, not relying on any centralized component. Still, Tribler > manages to remain fully backwards compatible with BitTorrent.

> Lengthy documentation in the form of two master thesis documents is > available. First is a general documentation of the tunnel and relay > mechanism, Anonymous HD video streaming, .pdf 68 pages. Second is focused on > encryption part, called Anonymous Internet: Anonymizing peer-to-peer traffic > using applied cryptography, .pdf 85 pages. In addition, there are the > specifications for the protocols for anonymous downloading and hidden > seeding on this wiki.

The link that you provided is going to take up a few weeks of my spare time. Thank you!

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> We are in this "decentralized" web, is just that the giants have a habit into buying out anything becoming remotely popular.

Think end game capitalism. Capital amalgamation.

In fact, any modern corporation will be buying as many smaller parts as they can, and regularly firing 10-20% of the people every year (cisco , etc).

So then, the problem isn't in the "centralized" web.

<comment><USER11> Due to efficiencies of scale and network effects, centralization may seem inevitable. However, we can structurally offset some of this tendency using crypto-economics.

<comment><USER12> It's not inevitable. Centralization is a side effect of the CFAA and copyright laws. The reason that people aren't able to read Facebook on a user's behalf and multiplex the feed into a competing network is because Facebook will sue you and the FBI may arrest you if you do this.

As such, users are denied true competitive freedom to say "I prefer the way that NewThing does stuff". They instead have to say "I prefer NewThing, but my social graph is held hostage by Facebook."

I won't say anything in particular about network effects because it's usually taken the wrong way, but there's no reason any of this lock-in has to exist on the digital web. We've _chosen_ it by giving extremely strong legal protections to existing tech incumbents.

<comment><USER10> Network effects will sooner be broken by a legal, than a technical solution.

</comment></comment></comment></comment><comment><USER13> Is there any sort of free open source internet search project? Similar to OpenStreetMap for open map data. Searching hasn't found any.

<comment><USER14> Also, the amount of open source software libraries for search is disappointing.

Somewhat strange, because searching is one of the pillars of CS.

</comment></comment><comment><USER15> I'm sad they don't mention urbit.org. Urbit aims to solve a lot of these problems at once (storage + identity + social + platform).

<comment><USER7> This part made me laugh out loud: "and "Arvo," a functional network OS, which is also a database." [https://bitcoinmagazine.com/articles/urbit-the-bold- pitch-to...](https://bitcoinmagazine.com/articles/urbit-the-bold-pitch-to-re- decentralize-the-internet-on-top-of-the-internet-1468257340/)

It seems like they've had a professional story teller masticate their ideas into good descriptions.

But really, if you had to describe it in 5 buzzwords or less would it be a "federated crypto p2p lambda server"?

<comment><USER15> Curtis loves to write about political philosophy and it's clear some of that has leaked into the urbit project--which isn't in isolation bad. It does seem to deter a general person simply interested in what the project is all about since you have to cut through the obscure language.

</comment></comment></comment><comment><USER16> Started reading last night. No technical expert but I came of age after the widespread use of the Internet. Many people, my age and older, can care a less about the philosophy of decentralized platforms.

However could you combine usability of centralized platforms with a decentralized platform focus on privacy, lack of ads, etc?

(of course how to pay for it...)

<comment><USER17> Regarding payment, I think you must take payment from your users (my recommendation would be donations, like Wikipedia).

This is because an organization's primary objective is self-preservation, and that means aligning priorities with income sources (or when you're designing the organization, aligning your business model with your priorities).

As we've seen with journalism, journalism's reliance on advertising leads to journalism designed primarily to attract viewers for advertisers rather than to serve the public interest (although good journalism does still happen because some journalists care about that despite their organization's priorities).

<comment><USER16> Wikipedia is a great example of a free decentralized product.

I suppose a way without having to ask for donations is one I would be interested in though I suspect there are " whales" who make up the bulk.

I think the issue with Wikipedia, though it has been able to scale to reach the world, is that it seem to lack the power to change how info is distributed and consumed in the spirit of Google and Facebook outside its digital border.

</comment></comment></comment><comment><USER18> To increase the competition via decentralization of the government control of internet

<comment><USER19> Removal of government control is a double-edged sword - government can be a huge barrier to innovation, but they can also _enforce_ innovation, by blocking monopolistic companies from being anticompetitive.

<comment><USER20> I feel like these monopolistic companies will have a lot more sway in any attempts at legislation than the disorganized, disinterested masses.</comment></comment></comment>


How to talk to recruiters at a career fair - <AUTHOR> http://kev.inburke.com/kevin/how-to-talk-to-recruiters-at-a-career-fair/

<comment><USER2> A student asking if a company is hiring full-time engineers is not naive in the slightest. You're writing purely from the perspective that all companies behave exactly like Twilio. In my experience (granted this was a couple of years ago), many companies at career fairs are sometimes looking only for interns. Some are just there for some advertisement, not hiring but still maintaining a relationship with the company.

With regards to the point about Java, rather than looking at just the language, I would think it's more worthwhile to see what a person has built with the tools they have knowledge of, rather than extrapolating that they are unwilling to learn something new.

</comment><comment><USER3> I'm really sick of people saying that you shouldn't wear a suit to a career fair. I understand the implication those who say it are trying to make, but it just doesn't work out that way. Any career fair I have been to, especially when it's for students, the kids dressed down are not doing so because they are confident and talented enough to not worry about impressions. Instead, those are the kids who either did not care enough to prepare for it, possibly have a class assignment that requires going or most often, just take themselves too seriously to be a viable candidate.

Also, to recommend that someone dresses down for the few positions that might be okay with that really limits who the student can meet with. While a few companies may be casual and willing to take someone in who didn't put the time into even preparing themselves for the career fair, many companies (including quite a few bigger companies that would be more likely to hire and invest in new talent) would be turned off immediately.

<comment><USER4> There's preparing yourself for a career fair (which I would characterize as having a fairly specific "hit list" of companies to speak to and topics to talk to them about) and then there's wearing a suit (spending at least $100 on a rarely-worn garment on a college student's budget). One of these is a much more meaningful activity than the other. And given the culture of technology companies and the high demand for developers, you _want_ to limit who's going to take you seriously.

</comment></comment><comment><USER4> (on not knowing what specifically you want to work on) "If you are not sure, one good strategy is to rotate - tell one company you'd like to do frontend work, tell the next you'd like to work on mobile and tell the third company you'd like to work on big data. Next summer (or in your spare time) you can try out something different."

...so instead of you just randomly picking what subfield to slot a college hire into, you're asking them to pick randomly and lie about being interested in it?</comment>


Silicon Valley Losing Middle-Wage Jobs - <AUTHOR> http://www.nytimes.com/2008/02/19/technology/19valley.html?_r=1&ref=technology&oref=slogin <comment><USER2> The article is trying to give the impression of a vanishing middle class, but the data really don't seem to back it up. It defines "middle-wage jobs" as people earning between $30K and $80K, and notes that the proportion of these has dropped from 52% to 46% in the last few years. But with the exception of students, there's virtually nobody in Silicon Valley earning less than $30K anyway, so I suspect what this really means is that more and more people are earning over $80K, while the number of full-time workers earning less than $30K has remained close to zero.

Good news spun as bad?

<comment><USER3> I think the numbers encompass all jobs within the region-- not just tech ones, as you seem to be implying. If you include all employment sectors, then there are plenty of fulltime workers earning less than $30k: 27 percent, according to the article.

<comment><USER2> Hey, you're right. I totally missed that paragraph when I read it the first time -- I thought they were only reporting numbers for the "middle income" folks.

I'm actually amazed that the number is that high -- I figured that even the "menial" jobs would have to pay more than that in that region. It's hard for me to imagine anyone surviving in Silicon Valley on less than $30K, but I suppose that's just a failure of my own imagination.

</comment></comment></comment><comment><USER4> Because when real estate is in the millions, it's extremely unattractive to live there unless you qualify for government help or you're rich.

</comment><comment><USER5> "Confucius says, 'Of course, you want to be rich and famous,'" Leonard said. "'It's natural. Wealth and fame are what every man desires.'" But Confucius understood there is a moral decision too, and sooner or later an accounting begins.

"'The question,' Confucius said, 'is what are you willing to trade for it?'"

(From a great NG article about Silicon Valley during the DotCom boom that captures the energy and excitement of SV - [http://ngm.nationalgeographic.com/ngm/data/2001/12/01/html/f...](http://ngm.nationalgeographic.com/ngm/data/2001/12/01/html/fulltext3.html))

</comment><comment><USER6> Their data seem to support my vague impressions:

<http://news.ycombinator.com/item?id=116415>

<comment><USER7> I'm currently saving for my flight trip to come from France to the US and now that I read this kind of thing I wonder if my objective of moving to the SV is not just plain foolish.

I was born in L.A but I was raised in France, I learned my english mainly from video games and the internet. Now I'm 26 and I want to come back to my home country, hit the reset button and start a new game.

For some reason I have a strong appeal to the west coast, but since I'm the kind of person that has to save for a flight trip, maybe SV is not for me. I'll be coming in about 3 months, should I land in L.A rather than S.F ? My initial objective was to meet interesting people around the start-up world and try to infiltrate the place this way. Maybe it's the wrong approach.

Maybe the question should be : where is the best place to struggle at first ?

<comment><USER6> SV has a lot going for it, and isn't a bad place to go at all. Go for it!

My main objection is that it's a place for people like you to go, try, see how they do, and then most likely move on. Most people move on because if you're not rich, it's a bad place to try and raise a family and be part of a community with some permanence to it. And even if you're rich, stuck in traffic on 101 is stuck on traffic on 101, no matter how many millions you have in the bank.

If settling down and raising a family isn't in your immediate future, then, absolutely, go there and have a great time! You'll learn a lot and probably have a great time.

<comment><USER8> "Even if you're rich, stuck in traffic on 101 is stuck on traffic on 101, no matter how many millions you have in the bank."

Wise words.

<comment><USER9> If you're rich enough, you negotiate landing rights at Moffett, right next to your office.

<comment><USER6> More realistically, you could have a helipad. Still though, my idea of perfection would be someplace where I can live most of my life on foot. I think that that's something a lot of US towns get wrong, especially on the west coast.

<comment><USER9> I agree with you. That's why YC is in Cambridge half the year. It's the most walkable town in the US.

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> I think many of those mid-tier IT jobs are now outsourced to India and elsewhere. CSRs, some system administration, and a lot of workaday programming -- the attitude is, get Bangalore to do it, whenever possible.</comment>


Ask HN: I am a US Citizen and I own a Canadian Corp and a US LLC ..Tax advice? - <AUTHOR>

So I run a company by myself that has a physical and legal presence in both the US and Canada. (Business Banking, address, merchant processing, etc). The Canadian company is a Corp, the US entity is an LLC (Washington State). I am a US citizen who recently relocated from Canada back to the US.
I have no idea what I'm doing re: tax. My first year I stumbled through filing a net loss in Canada. Now that I'm doing significant money, I'm looking for some high level advice. One of my main questions is how to declare money that I've drawn from the Canadian company for living expenses. Since I can't legally work in Canada, I'm guessing it has to be a dividend. I don't want to get double taxed either.. the money is pretty substantial.
Thank you for any pointers. This is a bootstrapped business, so hiring the kind of accountant I would need to handle international tax seems too prohibitive. <comment><USER2> 1\. Your Canadian corporation is a controlled foreign corporation. See Form 5471. It may or may not generate Subpart F income. Penalty for fucking up -- even modestly (like filing a day late) -- is $10,000 with surprisingly little mercy. Likely fees for preparing Form 5471 by someone who has a clue: $7k and up. No easy alternative except kill the corporation. Uncle Sam hates small business operating internationally.

2\. If you are the sole member of the LLC the LLC is disregarded and all of the income flows to Schedule C. Haha :-/ you will pay self employment tax on your profit. If you're doing well the combined tax load will exceed 50%. Uncle Sam hates the self employed. If your LLC is owned by the Canadian corporation you are well and truly fucked. You have the Form 5471 problem. You also have to file a corporate tax return in the USA for your Canadian corporation (Form 1120F) and submit its income earned in the USA via the LLC to US corporate income tax plus branch profits tax so the combined corporate tax rate will exceed 50%.

3\. Finding competent experienced help in this area is extremely hard. When you find people they are extremely expensive.

4\. Sorry for the bad news.

5\. There are a shit ton of other forms to file. Eg when you created your Canadian corporation you should have filed Form 926 to report the capital contribution to the corporation. Moving ownership of IP from a domestic to foreign owner can cause taxation. Etc.

6\. Again, sorry. My contact info is in my profile. I'm too expensive for you but I will try to point you in the right direction. Maybe HN needs a webinar for cross border startups like yours. :-)

<comment><AUTHOR> I did stumble across that form 5471 while googling. Ouch. I will PM you, thank you for your advice.

<comment><USER2> Another fun fact: from the Canadian tax perspective, a U.S. LLC is taxed as a corporation. If you had your LLC while you were living in Canada you'll need to see what Canadian exposure you have for that.

</comment></comment></comment><comment><USER3> It is time to consult with a Certified Public Accountant with experience in international corporate tax matters. Or perhaps a chartered accountant in Canada, in addition to a CPA in the USA.

The accountant(s) can save you a lot of money by advising you on appropriate record keeping, business entity structure, appropriate characterization of the transactions you describe, as well as knowledge about tax rules that you may trip over (with associated penalties). Plus hiring one would allow you to spend your time and effort better on the business you know.

There are some very significant rules for bringing money into the US, from a tax perspective, with heavy penalties for failing to do so with appropriate tax declarations.

Since you are apparently profitable, this should not be a burden to you, and if you're not, yet have significant assets, conducting the tax matters appropriately is a cost you are able to pay to avoid trouble, and avoid needless risk.

I'd estimate you can save enough money by being well-advised that it would more than pay for the professional fees by avoiding trouble, and perhaps by taking advantage of appropriate tax rules for your situation that you are unaware of.

It is a good accountant's business mission to save people more money than their cost, and aid people to grow their business.

Doubtless you have business relations with people who have accountants they trust and rely on. Just like hiring a lawyer, you can talk to an accountant in a hiring conversation to learn of their expertise, interest and compatibility with your desires, without the obligation.

There are business associations, such as Chambers of Commerce (since you're in a border state) that may have people who have experience or opinions about people or firms to suggest you might engage. Work your network.

<comment><USER3> If I were in your situation, at the start I probably would have looked into having the Canadian entity contract with the US entity for services, so that the US entity is the one paying you personally (but that also may involve registering the US entity in Canada).

The tax season has now started for accountants, it being January, so it is desirable to talk to and engage someone quite soon before they are too busy with their existing clients to deal with you.

<comment><AUTHOR> Thank you for your tips. Can I retroactively subcontract (the books) canadian --> US? That makes a lot of sense, otherwise I think I'm facing a double taxation problem.

<comment><USER3> A question to get an answer to from your new professional advisor, is, can you reasonably and legitimately treat those payments as personal loans or advances (if paid to you and not paid to third parties), pay these loans back at this point to the Canadian entity, and belatedly contract between Canadian/US entities for services rendered.

You're a couple of years late on getting good advice on business entity structures and relationships...since you've been operating for a while now.

</comment></comment></comment></comment><comment><USER4> I'd recommend talking to a Canadian CPA. In my experience Canadian CPAs have far more relevant experience dealing with Canada-US taxes than US CPAs do, most US CPAs are focusing on other pools of countries.</comment>


Dwolla updates and expands API - <AUTHOR> http://blog.dwolla.com/major-api-updates/

<comment><USER2> Love the expanding product. Keep your eyes here.</comment>


Ask HN: Consultants in Montreal willing to let me shadow them? - <AUTHOR> Shadowing is an excellent way to learn how experts work. Sadly it's mostly overlooked. I would greatly appreciate the opportunity to shadow a consultant/senior engineer, and I'm willing to use my skills to help them in day to day operations.
Further details can be discussed by email - mine is in my profile.
Edit: Wikipedia link for those wondering what shadowing is: https://en.wikipedia.org/wiki/Job_shadow <comment><USER2> We have shadowing but only for team-members shadowing myself [https://about.gitlab.com/handbook/ceo/shadow/](https://about.gitlab.com/handbook/ceo/shadow/)

Cool to see other people realizing the value of shadowing, I hope you find someone.

And for people considering to be shadowed: it is an easy way to help someone, you act better, and you tend to learn from the shadows questions.

<comment><AUTHOR> It seems that Quebec is now a place you can hire from, so I guess I have to start by applying for a job at Gitlab then. :)

It's wonderful you have this initiative - Gitlab seems to lead by example in many progressive practices.

<comment><USER3> Isn't it Québec anti business and with arcane language laws ? Why would anyone start a business or hire someone from Québec ?

<comment><USER4> What? The tech scene in Montreal is far from small. The "régions" also have a huge number of startups, funding, incubators, collaboration with local universities, etc. Language/politics don't keep us from working together.

</comment></comment></comment></comment><comment><USER5> I am a consultant software engineer who works in multiple exciting fields (algorithmic trading, complex networks analysis, open source intelligence analysis). I live and work in Geneva, but I happen to be in Montreal for two weeks starting next Tuesday, so perhaps we could find a common ground. I'll write you.

<comment><USER6> Hi Alexander, could I get un contact with you? Id like to name you some questions if possible.

<comment><USER5> Sure, my email is in my profile.

</comment></comment></comment><comment><USER7> Consultants in what field?

<comment><AUTHOR> Software, sorry if it wasn't clear.

</comment></comment><comment><USER8> What's shadowing?

</comment><comment><USER3> Who would in their right sense will work in IT in Montreal ?

Isn't Québec anti immigrant and bad for any kind of business other than a Québecois one ?

I mean the language laws, anti immigrant and right wing CAQ with the recent religious ban law. Shitty noisy apartments, highest income taxes and crumbling infrastructure including lack of healthcare professionals.

<comment><USER9> I've lived in montreal snd quebec city, have visited and considered working in many other cities and countries, yet I find that it is mostly worse everywhere else, or at best on par. Not that quebec is perfect or anything.</comment></comment>


Posterous Acquires Fellow Y Combinator Alum Slinkset - <AUTHOR> http://www.techcrunch.com/2009/06/23/posterous-acquires-fellow-y-combinator-alum-slinkset/

<comment><USER2> Is "acquires" just a fancy term for "agreed to work together"?

<comment><USER3> that's usually a partnership. an acquisition typically involves quite a bit more on the business and operations side.

<comment><USER4> How can a company with only $740K (<http://www.crunchbase.com/company/posterous>) afford to acquire Slinkset? Equity?

<comment><USER3> probably a stock swap.

</comment></comment></comment></comment><comment><USER5> Congratulations guys!

(even more so because there is a screenshot of my slinkset on Techcrunch!)

</comment><comment><USER6> Well, that's one way to get exceptional coders (I assume Garry and the other Sachin made them sign employment agreements).

<comment><USER7> Since the acquisition was likely done with stock, vanilla vesting would be enough to make them stick around.

</comment></comment><comment><USER8> Does anyone have any ideas how posterous intends to make money?

<comment><USER9> Well, you could take a look at WordPress (whose revenue growth is pretty enviable). Hosted blogs, premium add ons.

</comment></comment><comment><USER10> Congrats to both the companies, the future is bright for both kind of services as stand alone's or as an integrated service.

</comment><comment><USER11> It's unusual for one YC company to acquire another, right?

<comment><USER3> i think it will become inevitable. as yc increases its number of investments, there will be more companies doing similar things and competing. i think the ethos of yc is to prefer a partnership (or downright acquisition) over competition, as most times, you have other competitors, and you can find ways to team up and take on the big guys. why not work with the same people who went through the same seed fund as you? the real question is: at what point is it acceptable to merge or get acquired?

paypal and x.com were a great example of what can happen through a merger. they could have spent their time killing each other, but they merged and set their focus on much bigger things: taking advantage of ebay's mismanagement and poor execution to deliver the world's leading online payment platform.

private acquisitions seem strange, but i have always believed that the real reason large companies cannot form from start-ups is because people may be too resistant to team up with their leading competitors to take on an even larger competitor. i wonder what would become of microsoft had they not teamed up with ibm, or apple.

<comment><USER12> From what I have read, I think the PayPal and X.com merger did more harm than good. There were a ton of ego clashes, technology preference differences (unix vs. .net), etc.

But merging with the right team will certainly help, and I am sure the 2 teams coming out of the same YC class probably know each others' capabilities fairly well.

</comment></comment></comment><comment><USER13> Congrats Slinksetters!

<comment><USER14> This doesn't appear to be their exit; more like a new beginning.

<comment><USER13> Is that any less deserving of congratulations?

<comment><USER14> Not at all; I was just under the (mis?)impression that you intended to congratulate them for something that hasn't happened yet.

</comment></comment></comment></comment><comment><USER15> did some money change hands?

<comment><USER5> They're not going to tell us, but it seems obvious to me that the bulk of the deal was in stock. Crunchbase has posterous's funding as YC's 15k + 725k in an uber-angel round which doesn't make a cash acquisition realistic.

<comment><USER6> I am the other Sachin Agarwal (at Dawdle.com), and I know nothing, but I will say this: I will bet you a beer that you're wrong.

As an acquiror, you want to do a deal as cheaply as possible. Given that Slinkset never really took off while Posterous has, a deal was probably done in the sub-six figures or perhaps none with just offers of employment. At this point, even though you lose the cash, it's cheaper to use $50K cash than $50K in stock given that you'd reasonably expect the stock to appreciate in value at this point. Acquisitions usually only happen in stock in either "pooling" transactions (i.e. Kayak/SideStep), where the acquiror cannot afford to pay cash (i.e. pick your _keiretsu_ deal from the late 90s), or the seller values the stock more than cash (i.e. Twitter/Summize).

Why, yes, I _am_ a former technology M&A investment banker.

<comment><USER7> It depends on how much you want them versus how much they want you. If you can't attract them with just cash, you're going to have to give stock. Considering the Slinkset guys are hungry entrepreneurs who'd probably want a stake, and an all-cash transaction in 6 figures wouldn't make them f@#$-you rich anyway, I'd guess this was a most- if not all-stock deal.

It also depends on what Posterous's cash situation is like; if much of the 750k is lying around idle, they'd want to spend it, else they'd rather avoid having to raise money again, which would result in giving up even more equity. Plus, all else being equal, I'd rather share equity with cofounders/employees than with investors.

</comment></comment></comment></comment><comment><USER16> Is it really newsworthy?</comment>


IBM launches open source tool for authoring HTML5 in the browser - <AUTHOR> http://maqetta.org/

<comment><USER2> Unfortunately it seems to be under heavy enough load that it won't quite work right.</comment>


What Happens When You Send a Zero-Day to a Bank? - <AUTHOR> https://privacylog.blogspot.com/2017/04/what-happens-when-you-send-zero-day-to.html <comment><USER4> There needs to exist a legal entity/non-profit or company that acts as a shield and/or escrow for these kinds of situations. Basically, as a researcher you can have them deal with the company/organization for you, including dealing with any threats, collecting any bounties due, and such. The company could have domain expertise of the industry, laws, and generally be a force against these companies -- the analogy would be a lawyer.

This is for cases where you want the credit but still want the protections afforded by being somewhat anonymous. Similar to WikiLeaks but more focused on allowing the company or entity to solve their problems and representing fairness on all sides.

<comment><USER5> Personally I think this is a function the the FBI should fill. However, there is a risk they would sit on zero days and weaponize them (or give them to another three letter agency).

I wonder if an org like the EFF could add this to their scope.

<comment><USER6> > However, there is a risk they would sit on zero days

Unlikely. They are still here to protect americans, in a sense. Stealing money from a bank or a regular business is not on their agenda.

There is a 10% of vulnerabilities that might have re-use for intelligence purpose, but it shall be alright for the bulk of it.

<comment><USER7> > They are still here to protect americans

That may be the charter of the the organization. But the individual people running the FBI goals are to 1) be reappointed / not get fired 2) continually expand their budget / power. Given US politics 1&2 are not always congruent esp in short term with "protecting americans".

<comment><USER8> Have you ever interacted with law enforcement on any professional basis?

They aren't like that at all.

<comment><USER7> 1) yes, but with the "troops" and lower level managers.

2) the Director of the FBI (and other other high level managers) is much more of a political bureaucrat than they are a LEO.

</comment></comment></comment></comment></comment></comment><comment><USER9> On a similar, but separate note, my bank launched a new version of its online banking platform. From launch I noticed it opened my accounts in a new tab while leaving my credentials (password and all) in the sign-in form. Not so bad when signing in from home - horrific if you're signing in from a public computer. I tweeted to the bank and spoke to someone on the phone about it. It's been 3 months and the bug is still there.

[EDIT] I decided to log in today just to see if it's still there (was a couple days ago), and it's finally been patched. If I had used a throwaway I would gladly let you guys know the bank, but I won't since it's trivial to find out who I am from my handle.

<comment><USER10> Who logs into their bank from a public computer? Genuinely curious.

<comment><USER11> There's plenty of laggards who don't have home internet and only browse through e.g. a library computer. Some of them are probably doing banking too, given the recent trend of preferring online transactions

<comment><USER12> > laggards

Or, you know, poor people.

</comment></comment></comment></comment><comment><USER13> For anyone being as confused as me in the timeline bit: The author is called Will(iam) Entriken. So "Will" and "Entriken" is the same as "I" and passive voice.

<comment><USER14> Yes, this was needlessly confusing in the blog post.

</comment></comment><comment><USER15> Kudos to the author, and hopefully they don't get sued as a result. This bullshit with corporations trying to cover up security vulnerabilities (rather than fix them) needs to stop.

"Sign this NDA or we will send the FBI to arrest you because you found that our _banking website 's security_ was completely fucking broken and told us about it." Jesus fucking christ.

<comment><USER16> No one should independently contact a company about this type of issue without first obtaining competent legal advice. And I do mean _competent_ advice; most lawyers are very technically illiterate and will not be sympathetic, let alone familiar with the relevant areas of law.

The researcher is lucky that TradeKing believed their NDA trick was sufficient. Even if the case here is weak, and I wouldn't necessarily assume it is, it would still seriously damage the researcher's life.

Here's how it goes when you get sued by a big company. Their lawyers essentially have a heyday doing everything possible to obstruct and delay the process so that they can maximize their time on the corporate teat. It will go on for years; they won't mind because it's business as usual for them, and they're getting paid big bucks to torment you. Your life will be ruined: assets seized pre-emptively, reputation and credit destroyed, inordinate quantities of time consumed by legal research and tedious paperwork, struggling (if not immediately blatantly failing) to keep your incompetent counsel paid at $250/hr and meet the retainer, and eventually failing to file some document or pay some fee that will cause the court to enter a default judgment against you and permanently confiscate everything you own, leaving you with the albatross of a massive outstanding judgment waiting to be enforced, bank accounts garnished any time you get any money, etc. And that's the short version!

And then guess what -- if, by some miracle, you don't lose in the first round, this whole process will repeat as they file appeal after appeal. Hunker down because the proceedings will last at least 5 years.

The corporate lawyers will be able to justify all of it to their clients without blinking an eye, who probably forgot that they even asked them to sue you. Everyone at the company and the law firm will go home and sleep soundly on their piles of money, and you'll have learnt your lesson that trying to stop the subterfuge of an online trading platform is a terrible offense.

Good reading: [http://www.nissan.com/Lawsuit/The_Story.php](http://www.nissan.com/Lawsuit/The_Story.php)

IANAL.

<comment><USER15> My father is a (technically literate, he used to be a database architect) lawyer, and the general advice he gave me was that if you are in a situation where you have a critical vulnerability you should disclose it through a lawyer anonymously -- your identity is then protected under attorney-client privilege (assuming you haven't just asked your lawyer to commit a crime by disclosing it).

IANAL though.

<comment><USER17> Interesting idea. Thank you for sharing. Is the goal just anonymity? Technically we already have solutions for anonymous disclosure of documents. Are there other benefits?

<comment><USER15> A technical solution to the anonymity problem would probably work just as well (assuming it wasn't backdoored), though the protections against a lawyer disclosing their client is legal rather than technical (so the "splatter" from a company's over-reaction are more likely to be smaller). You also get the additional benefit of the company probably taking a disclosure more seriously if it comes with a law firm's letterhead (unfortunately).

</comment></comment></comment></comment></comment><comment><USER18> The NDA is not a valid contract because there is no consideration. For a contract to be valid each party has to gain something. This is why many contracts include a token consideration of $1. This one didn't, so it's invalid.

<comment><USER19> Consideration is a common law concept as far as I can tell. As someone unfamiliar with how it came to be: Why was consideration introduced? What's the rationale, the goal behind it?

<comment><USER20> IANAL

A contract is what lets you sue someone over a private transaction. That's what it does, that's all it does. If for whatever reason you're not willing to bring a contract dispute to court, then your contract doesn't do anything and you wasted your time writing it. Contract = right to sue for breach of contract.

In order to sue someone, you need to be able to describe what damages have been done to you. The goal of a lawsuit is for the responsible party to 'make you whole,' i.e. pay you back an amount equal to the damages done to you.

In a contract dispute, the 'damages' of breaking the contract is equal to the 'consideration' of fulfilling the contract. In other words, the promised consideration is the actual thing that you can sue over.

If there is no consideration, then there are no potential damages, and there is no potential lawsuit. And since the only point of a contract is to enable a lawsuit, a contract that doesn't do that isn't a contract.

<comment><USER21> _" the 'damages' of breaking the contract is equal to the 'consideration' of fulfilling the contract"_

This is categorically incorrect.

Damages for breach of contract are supposed to put you back in the position you'd have been in had the contract been performed. It's not related to the value of the consideration.

Consideration is one of the things needed to make a contract binding in English law (along with offer & acceptance, and "intention to create legal relations").

Jurists still debate the rationale for consideration, but the best answer I've found is that contract in English law is seen as an exchange or a "bargain". There is no gratuitous contract, donations are not contractual right.

By comparison, a contract under French law is based on "consent of the parties" and the theory of individual autonomy. There's no requirement for consideration.

In a "mutual NDA", consideration is easy to find; each party agrees not to disclose confidential information disclosed by the counterparty.

Another way to make an agreement binding without consideration is to sign it as a deed.

[https://blogs.warwick.ac.uk/anneprudhomme/entry/consequences...](https://blogs.warwick.ac.uk/anneprudhomme/entry/consequences_of_illegal/)

<comment><USER22> > In a "mutual NDA", consideration is easy to find; each party agrees not to > disclose confidential information disclosed by the counterparty.

I don't think mutual NDAs are typical. Typically, you sign an NDA prior to receiving information. So the consideration for signing the NDA is receiving the information that you agreed to not disclose. If you already have that information, then that's no longer valid consideration.

In this case, the reporter _already_ knew the security vulnerability, so that knowledge could not be considered consideration. The bank would have needed to offer something else.

</comment></comment></comment></comment></comment><comment><USER23> Lesson learned: when reporting a vulnerability, record all discussions from first contact with the vendor. At least in cases where the vendor doesn't have a clear, easy to find policy and/or bounty for disclosures.

I think it's totally fair to reject an NDA but I don't blame him for fearing an overzealous reaction on their part. Even being on the right side of criminal and civil law, you really do have to be willing to spend time and money to mount an affirmative defense.

<comment><USER24> I believe that you'd need to tell them that they were being recorded or you could get yourself into trouble.

Edit: looks like this could be possible without getting into trouble depending on the state you're in: [http://lifehacker.com/5491190/is-it-legal-to-record- phone-ca...](http://lifehacker.com/5491190/is-it-legal-to-record-phone-calls)

<comment><USER25> As someone who lives in Texas, I can confirm that Texas is a one-party state. I specifically do _not_ need to inform people of recording devices _if I am a party to the conversation_.

It bothers me a lot when services, such as Google Voice, announce to all parties that such recording is occurring.

<comment><USER26> > It bothers me a lot when services, such as Google Voice, announce to all > parties that such recording is occurring.

Google is based in California. There is a good probability that the act of recording occurs there. California is an all-party consent state. Also, even if the recording isn't happening in California, it's potentially tricky to be sure that no party to the call is in California (even numbers assigned to landlines don't assure that the person ultimately connecting is in a particular place.)

<comment><USER27> From my naive understanding and possible spotty recollection of the law(s) involved: in the US at least, as long as the recording party is in a one-party state then it doesn't matter where the other parties are located.

</comment></comment></comment></comment></comment><comment><USER28> In Finland, most online stores allow you to pay for your shopping directly using your online bank. The way it works is the online store calls the bank's e-payment API, which in turn lets the user authenticate using their normal online bank credentials and accept the payment.

A few months back I did some research [1] on these e-payment APIs and noticed that one of the major banks had a serious flaw in their API implementation. It was possible for the end-user to manipulate the signed API calls to change the payment amount, effectively paying less than the actual price for products they buy.

I reported the issue to the bank and got a swift response where they acknowledged my report and said they were looking into it more closely. A few days later I got another email where they basically said "ok, this looks bad, and we can see it's pretty trivial to exploit, but... it's too expensive to fix, so we won't do anything".

I wasn't comfortable with this, so next I reported it to NCSC-FI/CERT-FI. They also agreed that it looked bad, but said that they had no way of forcing the bank to take action. So that got me nowhere either. I haven't heard from either NCSC-FI or the bank since, but the issue does appear to be partially mitigated now.

I've since found several other issues in the same bank's systems but haven't bothered to report them since they don't really seem to care.

[1] [https://www.slideshare.net/JuhoNurminen/the-sorry-state- of-f...](https://www.slideshare.net/JuhoNurminen/the-sorry-state-of-finnish- epayment-apis)

<comment><USER29> Post them anonymously and see how fast they become too expensive to not fix.

<comment><USER30> Unless you think this would actually lead to banks taking such vulnerabilities more seriously in general--which I don't believe is the case--taking an action like that is _pure_ spite. Consider the possible outcomes for this particular vulnerability: [1] nothing happens, [2] it gets heavily exploited, customers lose money, and it doesn't get fixed, [3] the same thing happens and it does get fixed. In all three cases, the outcome is at least as bad as it would have been had you done nothing, except possibly earlier and worse.

I really take issue with the notion that security is important, so you're fully justified in screwing people and companies over as much as possible to prove a point. That seems to be a common attitude in the security community. I get the frustration people have with the intransigence of corporations and programmers, and people's general stubborn unwillingness to understand the severe impact of vulnerabilities, but if just security-shaming companies into fixing bugs actually worked we would have a much more secure internet today than we actually do. Unless you can get regulatory agencies to start holding companies and individuals _legally_ accountable for security issues (that is, making it more expensive not to fix than to fix), _nothing_ will change, even if you have all the technical solutions and social pressure in the world.

<comment><USER28> Also a big issue here, as with many software vulnerabilities, is that the people the public disclosure would actually damage are the users, not the company making the vulnerable software. The bank would only start losing money if the users (personal customers, business customers using their APIs) would notice the hack and start demanding their money back.

<comment><USER17> It would be very nice if your security disclosure report included a section about how you have provide good faith upfront notice to the vendor and that based on research and belief it would be negligent for the company to not fix the issue by X date.

The wording you choose should be cognizant of your state's laws and the company's user agreement in such a way that the company is actually at risk if they ignore you.

When talking to people, "Reason is, and ought only to be the slave of the passions".

When talking to companies it is only necessary to discuss the impact on their profit.

<comment><USER28> Just to be clear, I haven't really disclosed anything publicly, not regarding the e-payment API issue or any other issues for that matter. The SlideShare from my comment references the e-payment API vulnerability but doesn't disclose any technical details. It's not possible to reproduce the attack based on the slides alone.

</comment></comment></comment></comment></comment></comment><comment><USER31> In Germany you can contact the CCC to walk you through the process of reporting vulns like this one. I'm sure the EFF does similar things for US citizens. A quick Google search brought up this FAQ: Coders' Rights Project Vulnerability Reporting FAQ ([https://www.eff.org/issues/coders/vulnerability- reporting-fa...](https://www.eff.org/issues/coders/vulnerability-reporting- faq))

</comment><comment><USER32> There was no value in discussing this over the phone. Clearly their only motivation was to trick him into signing the NDA or foolishly becoming an employee to keep him silenced. Just send in the bug report and empty your account. If the bug persists after 6 months then close the account and go to public disclosure.

<comment><USER17> Yes, this is my new IJDGAF policy. The phone call was a losing proposition from the beginning.

However if the FBI and NCFTA were /genuinely/ interested in disclosing this in their forum for other banks then maybe my phone call with them may have been a win-win. But I think they were not genuinely interested.

</comment></comment><comment><USER33> About a month ago I noticed that my bank had a vulnerability - I could access the details and photos of every remotely deposited check. I sent them an email, they took the feature offline in about 2 hours.

No bug bounty but oh well.

<comment><USER34> My bank used to show deposited check photos in a popup with the URL viewable iirc, and sometime they switched to a modal window with base64 data as the source instead of a URL that might be manipulated. I wonder how many small banks still may have bugs like that

<comment><USER17> Modifying a data: url is a feature not a bug.

</comment></comment></comment><comment><USER35> I think they're regarding these things as weapons, because that's how they or others are using them.

It doesn't matter how we regard CVEs as a community, this is the truth of the matter outside of it. We're handing them over a bomb, and they want to know why. It feels very Spy vs Spy to me, as silly as that sounds.

<comment><USER36> That was my experience when I stumbled across a text file with several thousand credit card numbers, which included tons of details about each card holder, including SSN.

I tried reporting it to the credit card, and to the issuing bank, and to the FBI. The only thing I asked was that they cancel the credit card accounts and put a "potential fraud source" note on each customer's account. Each party I called was more concerned with threatening me, and trying to find out what kind of criminal angle I was playing, and what my ulterior motive was, etc etc. I honestly expected to hear "Oh dang, that sucks, we'll close the accounts and contact the victims", and was depressed at the hostility I encountered.

<comment><USER37> Suppose they granted your plan to "cancel the credit card accounts" and "potential fraud source" note on each account.

That's pretty much trying to shut down business with their customers. You don't see how they'd interpret that as hostile? Future actors would know how to apply similar techniques if the outcome was in their favor (e.g. Anonymous suddenly produces a large file of cc#'s and threatens bank!)

> The only thing I asked..

In fact, why _were_ you making demands about how they handle their customer relationships, instead of simply presenting what you'd found?

<comment><USER38> When you come across a single credit card number (say, by finding someone's card on the ground), the response by most financial institutions is to invalidate that card and mail them a new one. Why shouldn't the response be the same if you come across a stack of 100 credit cards?

<comment><USER37> The response to invalidate is a choice by the bank, not the person who finds the card. Also, that is a single number. It's suspicious/threatening for a non-trivial amount of cards when the presenter also makes demands.

<comment><USER38> How is "someone has stolen your clients information and likely already sold it to nefarious actors, because otherwise it wouldn't be on the internet anywhere, so you should keep them safe by deactivating those accounts" threatening?

I'd be annoyed if my bank _didn 't_ do something.

<comment><USER37> That is a different point. You are changing the party being considered by re- framing it under yourself, a customer, instead of considering it from the point of view of the bank.

<comment><USER38> That's ridiculous. If the bank is aware that my credentials are available online somewhere and are taking no action to protect me, they're being complicit in any harm that comes to be, because they have both the responsibility and ability to take action, and refuse to. They're being irresponsible and potentially harming their clients.

So again, how is saying "You should take action to protect your customers' data" a threat? How can it be interpreted as a threat? What is threatening about it?

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER39> I wrote this a couple years ago about Schwab's embarrasing security. Most of the issues are still there.

[https://jeremytunnell.com/2014/12/22/swab-password- policies-...](https://jeremytunnell.com/2014/12/22/swab-password-policies-and- two-factor-authentication-a-comedy-of-errors/)

<comment><USER40> FYI,

Password + token is a common pattern in systems where hardware/software/OTP tokens were bolted on after the fact.

Not just that, but on certain systems (think a Windows login screen, or a POP3/IMAP login for your e-mail client), you can't have a 3rd "token" field -- they're hardcoded to ask for just a username and password.

So vendors came up with the idea of appending the token value onto the password, and their middleware (say, a PAM module) splits the provided value into password and token and validates both.

EDIT: That's not to say that Schwab is doing it right (in the front-end, seriously???), but just pointing it it's not as uncommon as you think.

<comment><USER41> RADIUS backend to network equipment as well. Since RADIUS is old, it doesn't have great password hash/encryption support (afaik), so you don't use it over open networks already, and it's well entrenched / widely supported.

So have it with no encryption, and the back-end can pull the password and 2FA code apart and verify both of them, for all kinds of systems which have only a username/password prompt for logins.

</comment></comment></comment><comment><USER42> Wow. Going on with your life as a C-level executive with this knowledge, as if it's just all good, is just insane. I'm sure they're in the clear personally now, but I can certainly see why they would wanna sell their company fast after gaining this knowledge in 2010.

<comment><USER18> > I'm sure they're in the clear personally now

Don't be so sure. If they didn't disclose this to their buyers they are guilty of fraud. The statute of limitations has probably run out (I don't know which state has jurisdiction here), but delayed discovery rules may apply.

<comment><USER43> I'm not so sure it's fraud for 2 reasons: 1) how easy it would/should be for the buyer to discover the issue; 2) these transactions generally have very detailed disclaimers / disclosure -- basically making them 'as-is' transactions.

If I were a betting man, I'd bet the buyer knew about the issue and basically didn't care.

<comment><USER44> Yet security researchers go to prison for iterating the ID numbers in a URL to access private profile pages :/

This is negligent. If they are running banking ecommerce infrastructure and are unable to deal with 101 security risks then it is absolutely negligent. The "it is too complex for the average person" isn't an adequate defense.

The only thing is that there has to be someone who lost something of real value for it to go to court as negligence does it not?

<comment><USER17> This is good thinking. But you need iron tight wording when spelling this stuff out.

In your contact with companies you should say "Failing to fix this issue would be a violation of reasonably assumed security practices as required in LAW..."

</comment></comment></comment></comment></comment><comment><USER45> Archived copy, which can be read without JS enabled:

[https://archive.fo/8ZpDJ](https://archive.fo/8ZpDJ)

<comment><USER17> Thank you and I am sorry that my blog has offended your browser. Would you like to recommend a better hosting service I could use instead of the wildly antiquated Blogger?

I would like to migrate to my own domain with Jekyll or something. But I would not look forward to implementing commenting and trackbacks even though the blog is pretty modest any way in terms of using those features.

<comment><USER45> According to [https://news.ycombinator.com/item?id=13355531](https://news.ycombinator.com/item?id=13355531) , JS requirement is not a problem with Blogger per se, but with some of its themes.

</comment></comment></comment><comment><USER46> Exactly what happened to me with Starbucks ([https://sakurity.com/blog/2015/05/21/starbucks.html](https://sakurity.com/blog/2015/05/21/starbucks.html)) - threats, signing NDA, they disappear.

<comment><USER17> Thanks for sharing, I remember seeing this before. Fun to read again!

</comment></comment><comment><USER47> > _if somebody sent you an email with that code (even if you never open the > email)_

What is he trying to say here? How on earth would it be possible to execute the url in the context of _your_ zecco cookies unless it's openend in a (browser) in which you've logged into zecco?

<comment><USER48> I'm guessing if you used a popular web-based email service, or any browser email client, then this would be possible.

<comment><USER47> Possibly, but you'd still have to (try to) "render" it in your browser by opening the mail.

On a similar note, your web mail could fetch images in emails ahead of time, but that would still be out of your browser's context

<comment><USER49> Remember...... 2008. Many people still had "auto download pictures" enabled in their email.

</comment></comment></comment></comment><comment><USER50> Note to self: The right thing to do, if you find a serious vulnerability, apparently, is consult an attorney. Geez, what a world.

<comment><USER51> >Geez, what a world.

*America

</comment></comment><comment><USER52> Sheesh... From a personal liability standpoint, better to just post these things to the company anonymously. Give them the standard window (90 days) then go public.

</comment><comment><USER53> At least it was over http/s

Terrible nonetheless. Reminds me of how Mt. Gox used to hand out password resets with plaintext passwords in the query string on their own forums.

<comment><USER54> _Reminds me of how Mt. Gox used to hand out password resets with plaintext passwords in the query string on their own forums._

Sounds like somebody should write a book about all of the missteps in that debacle.

</comment></comment><comment><USER55> The craziest thing is how hard they work to cover it up and not fix it vs how blindingly easy it always seems that fixing it would be.

It's like circumnavigating the globe backwards in order to avoid using a crosswalk.

</comment><comment><USER56> this is a major bombshell. I'd hate to be those guys running zecco. The fact that they coerced an NDA to hide the millions of customer transactions that now have no way of proving were legitimate or not.

I'm pretty sure the author wasn't the _only_ guy looking for vulnerability. I'm pretty certain criminal minded folks would've already used it....with no way of finding out which are real or manipulated.

Which further raises the question, why they would go to extreme length to cover their tracks? They could've easily saved themselves trouble by coming clean but because they've gone such great length to hide it and threaten anyone who tries to expose it makes this a hollywood type story. That just seems so over the top like they are protecting something much bigger.

<comment><USER57> Worst case (?) scenario, they were abusing the system themselves or were being pressured to allow others to do so.

It's unlikely, but my point is it's a hole in their system which would allow this to happen and it seems like they've deliberately let it continue. :(

</comment></comment><comment><USER58> Nitpick: was this disclosed to a bank or a broker? Not sure it matters tbf

<comment><USER59> I believe you have picked an actual nit. He reported to Zecco (his actual broker) and Penson (Zecco's clearing firm). Both were SEC-registered broker- dealers at the time, neither were banks.

</comment></comment><comment><USER60> Serious question: Would the FBI actually come to your door if you went full disclosure with a banking zero day? Is there real legal exposure here or was that just bluster from Zecco/TradeKing?

<comment><USER17> Surely Raneri had no authority to speak for FBI.

BUT actually this vuln may have been from upstream with Penson. And then it may affect many broker-dealers. They have many clients in US and Canada. (Don't laugh that such a ridiculous vuln could be in so many places.)

At the time, considering this (and Penson was on the phone) I understood that irresponsible disclosure could have serious consequences. FBI would have been warranted to knock on my door.

That's why I'm now publishing 10 years after the fact.

</comment></comment><comment><USER61> >if somebody sent you an email with that code (even if you never open the email) then you would be the unwitting owner of one share of Krispy Kreme Donuts

Pardon my ignorance, but how would this work?

<comment><USER62> I felt ignorant first when reading it as well. But looking at the "FAQ" at the bottom, it says:

"But this only affects people that are logged in, right? Yes ..."

So I suppose what happens is, that the user is already logged into the service and thus has a cookie for the service in his browser.

If the user then somehow executes a request to the URL in the article with the same browser (eg viewing a malicous email with the IMG tag in a webmail client), the browser will enclose the cookie in the header of the request. This makes the request automatically authenticated.

<comment><USER61> >eg viewing a malicous email with the IMG tag in a webmail client

The article mentions it would occur even without opening the email.

<comment><USER63> Well, it is possible your email client is doing prefetching. I wouldn't rate it as probable, since you're unlikely to have a client with the same cookies than your web browser, but still.

You could also abuse Firefox and Chrome prefetching links. I'm not sure Gmail for example remove prefetching attributes in spam links. They do block images though.

<comment><USER61> Good point.

Anyways, how would it work with the server receiving any data from the client just by viewing the link in your browser?

</comment></comment></comment></comment></comment><comment><USER64> I would not be surprised if this turns into a class action lawsuit. The negligence here is remarkable.

<comment><USER65> You need damages to have a class action lawsuit. What are your damages?

I am not saying no one has damages, but if 100s of people had damages, I expect something would have happened...

<comment><USER66> Couldn't anyone who lost money on a stock be able to claim damages? How would the bank prove the purchase order was legitimate seeing as there's basically no security around the endpoint and the bank knew it?

<comment><USER67> The bank may be able to demonstrate that the vulnerability was not exploited by, e.g., showing that the order preview page was first loaded with the same parameters, or showing a same domain referer.

<comment><USER66> Maybe the bank should've used this method to prevent the problem in the first place by just checking that the referer request header was from their domain.

<comment><USER65> Is it proven anywhere that it wasn't?

<comment><USER68> The article mentions that unauthorized transactions were indistinguishable from legit ones:

>Also their engineers made it clear that unauthorized transactions like this and later shown below would not be distinguishable from other legitemate transactions.

</comment></comment></comment></comment></comment></comment></comment><comment><USER69> A strong argument can be made against revealing your name when disclosing information like this - especially if you're dealing with banks (often litigious and technically illiterate) and even more so if you're in the United States. If I was the OP I would've found a way of reporting this information to the bank anonymously. Possibly followed up with a promise of media disclosure if not fixed in a timely manner.

</comment><comment><USER70> Would he not have a case of gross negligence against Zecco if he were a customer? Is there something preventing a lawsuit, outside of the possibly non-binding NDA?

<comment><USER59> No damages, assuming no unauthorized trades were executed in his account as a result of the unpatched vulnerability.

<comment><USER66> Couldn't he simply claim unauthorized trades were executed? How would the bank be able to prove otherwise? Especially considering the bank knew about this huge security hole.

<comment><USER71> In order to do so, he would have to actually declare a claim that a particular trade was unauthorised. Assuming that he actually _did_ execute all his trades himself (which, frankly, is quite likely), making that claim in court would be a crime (perjury + fraud), a much serious issue than the security vulnerability.

With sufficient preparation it's likely, that the bank (and prosecutors) wouldn't be able to prove that crime beyond all reasonable doubt, and he wouldn't be convicted for it, but it still carries a risk that they could prove that (e.g. by forensic analysis of his computer) and he'd go to jail.

Furthermore, even if he manages to prevail in the criminal case, in the civil case (where the criteria is less strict) it is quite likely that after reviewing all possible evidence they'll manage to get to the correct judgement that the "unauthorised trades" claim was false, thus not getting him anything anyway.

<comment><USER66> How is the bank able to get to get the correct judgement in the civil case? There's proof the bank knew about the security hole, there is proof that at least one person outside of the employment of the bank had discovered this vulnerability (meaning there were likely more), and there is no way for the bank to prove that the transactions were legitimate. The article mentions that unauthorized transactions were indistinguishable from legit ones:

> Also their engineers made it clear that unauthorized transactions like this > and later shown below would not be distinguishable from other legitimate > transactions.

<comment><USER71> For starters, all the details on how that particular transaction was performed, timestamps, IP addresses, all the browser fingerprints visible in the logs of that request (they tend to be quite identifying), subpoenaed logs from the claimant's ISP.

They don't have to prove that it couldn't have been someone else, they have to convince the court that it's more likely than not. Motive matters a lot - <USER2> there's some way how that transaction would have been useful for a fraudster (i.e. if it was a money transfer to them), then it's one thing; but if there's no indication of why someone else would want to make the fraudulent trade (which is the case for most stock purchases/sells) and a clear motive why the claimant would want the trade to be reversed (i.e. the stock buy seemed good on that day but turned out to be bad afterwards) then if there's any technical evidence whatsoever pointing towards the claimant, it's hard to be convinced.

If data shows that the transaction is e.g. done from some Starbucks and local security cameras show the claimant near that Starbucks at that time, it's probably not enough to get a conviction but likely enough to make them lose the civil claim.

The criminal case would be expected to get much more evidence than an ordinary civil claim, so they'd likely wait for its results and use everything that the police/prosecutors gathered to dismiss their civil claim.

<comment><USER66> > For starters, all the details on how that particular transaction was > performed, timestamps, IP addresses, all the browser fingerprints visible in > the logs of that request (they tend to be quite identifying), subpoenaed > logs from the claimant's ISP.

Again, the IP address would obviously be associated with him and the browser because that's how the vulnerability works. The attacker just has to get the victim to visit any website with a browser which has the cookies for the bank. So proving that the user's browser/machine/IP made the request does nothing to show that the user did so intentionally.

> Motive matters a lot - if there's some way how that transaction would have > been useful for a fraudster (i.e. if it was a money transfer to them), then > it's one thing; but if there's no indication of why someone else would want > to make the fraudulent trade (which is the case for most stock > purchases/sells) and a clear motive why the claimant would want the trade to > be reversed (i.e. the stock buy seemed good on that day but turned out to be > bad afterwards) then if there's any technical evidence whatsoever pointing > towards the claimant, it's hard to be convinced.

It doesn't have to be done by a fraudster. The motive for the attacker could simply be to fuck with people. They don't gain anything but satisfaction from the fact that they were able to successfully exploit this vulnerability.

<comment><USER71> The attack would leave traces. Timestamps would show when exactly the request was made, ISP logs or data from the claimants computer would show other requests in the same seconds (i.e. wherever the victim got served the malicious link); Sending the img link by email would be visible in that email; getting the user to view a malicious post on some webpage/forum/etc is likely to leave evidence there.

In general, you make good points, they are believable and likely would be made if such a court case happened. In the absence of hard evidence, if they seem slightly more believable than whatever story the company presents, the claimant would win; if they seem slightly less believable, the claimant would lose. In a civil claim, the company needs to prove that it was authorised only just as much as the claimant needs to prove that it was not, it's a somewhat symmetric contest - simply claiming "I didn't authorise it" is effectively countered by claiming "Yes you did", and simply moves the discussion on to further investigation.

The motive _could_ be just a prankster messing with people, but it's a lot less convincing motive than an obvious benefit. If the transaction is one where you clearly lose money and someone (possibly anonymous) gains it, it's easy to make the case that you were hacked. But, for example, if the claimant had previously unsuccessfully complained to the company about the theoretical possibility of such vulnerability, and _then_ complained that a seemingly random transaction is unauthorized, I'm fairly sure that any decent lawyer would successfully convince the court that "a prankster did it" is comparable to "the dog ate my homework" and it's a bit more likely that they orchestrated the claim themselves to mess with the company. Getting 51% of belief is preponderance of evidence, and sufficient in a civil trial.

And in any case, all this wouldn't be "simply claim" \- seriously making such a claim would require a significant investment of time and money from the claimant. It's not something most people would do for fun. Some would do it to make a point, but that's quite a niche hobby.

<comment><USER72> Do ISP's keep detailed logs as far back as 2005?

<comment><USER71> Nope, but if you reported that you just noticed a fake stock deal made 12 years ago on an account that you actively use, you'd have an uphill battle proving that it really was unauthorised, and the lack of logs would only make it harder for you.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER73> Ugh, I hate hearing about crap like this. Unfortunately, the incentives at large, public, consumer-facing companies always drives this behavior.

I would have done the following:

1\. Shut down my account. 2\. Send the exploit to the company anonymously with a deadline to fix. 3\. Upon deadline, post exploit and cc the company.

The inability to publish is a rub, but I think we need a cultural shift to drive back corporate idiocy and protect consumers.

</comment><comment><USER74> Seems to me that given the way it's likely to be received, the proper way to disclose a vulnerability like this is anonymously, through a lawyer.

</comment><comment><USER75> I'm not quite following the timeline: why did he end up under an NDA and the too-long wait to get it fixed? Why not say "I'm publishing this on my blog in 30 days so it better be fixed by then"? Would you risk getting in legal trouble for publishing a way to do bank fraud (for example) - assuming you gave some reasonable timeframe for disclosure?

<comment><USER76> > Would you risk getting in legal trouble for publishing a way to do bank > fraud (for example) - assuming you gave some reasonable timeframe for > disclosure?

Of course you would. The bank would call the FBI and tell them you're hacking the bank, and the FBI would then knock down your door, tear up your house and drag you away. The system would then do everything it could to represent what you did as a crime, and if you are lucky you get away with only a year in court, many thousands in debt and your name dragged through the mud.

tl;dr The actual legality of an action is only tangentially related to how the legal system will be used against you in response to it.

<comment><USER75> So basically what's needed is a place to send these notices anonymously and a place to anonymously publish the exploit after responsible disclosure - <USER3> least for countries where legislation works like you describe.

I still hope this is not the case in most places outside the US - that is, I hope the responsible disclosure is complete proof you are in fact _not_ hacking anyone.

</comment></comment></comment><comment><USER77> Kudos for the balls to come public despite NDA.

<comment><USER78> Many are questioning the validity of that NDA in an earlier comment due to its complete lack of consideration.

</comment></comment><comment><USER79> Just to be clear I also find it appalling that any important institution would take their time in fixing such a simple exploit.

But it seems the reason why these cases don't get resolved quickly is purely for economic reasons: the perceived cost of fixing the issue seems (to them) is far greater than the cost of dealing with the (remote?) possibility of the exploitation of the vulnerability.

I also think the security researchers have an 'overgrown' sense of the urgency upon having discovered such exploits, and it never seems to get fixed fast enough from their point of view.

But understanding the forces that are at play, also helps understanding such an 'irrational' decision. Big institutions are not known to be proactive and the political climate in such environments does not incentive the 'doers' but does get people in panic mode to try to stop the leak, instead of the root cause (the exploit).

<comment><USER17> YES. Many authors love to write more than the readers love to read them.

FIRST, be reasonable. This is a good life axiom. Don't expect a large organization to confirm, engineer, test certify, and deploy a change that requires external documentation in less than 14 days. Even if the ship's on fire.

SECOND, be valuable. If you are reporting a vuln that is a bug report. When's the last time you got thanked for /any/ buy report for a non-GitHub project? If your report explains the cost and liability for lawsuit if they fail to fix your reported vuln then you are speaking their language.

\---

I have a confirmed vuln reported to Apple under their "responsible disclosure" program since 2015. They have yet to fix it or provide credit as they promised. If you thought Apple was a magic company that "does the right thing", then I hope this dispels that myth.

</comment></comment><comment><USER80> That's a lot of errors for one document.

<comment><USER81> I'm also kinda curious why the author didn't run through a simple spell checker before posting. I'm grateful for the article, it was an interesting read, but really why not just paste into google docs real quick or something?

<comment><USER82> Maybe his editor is on leave.

</comment></comment></comment><comment><USER83> Things have progressed quite a bit since 2008 fortunately. Vulnerability disclosures have become much more acceptable, and are handled in a much better way.

Lots more information about disclosure:

* [https://www.ee.oulu.fi/research/ouspg/Disclosure_tracking](https://www.ee.oulu.fi/research/ouspg/Disclosure_tracking)

* [https://www.ntia.doc.gov/blog/2016/improving-cybersecurity-t...](https://www.ntia.doc.gov/blog/2016/improving-cybersecurity-through-enhanced-vulnerability-disclosure)

* [https://www.thegfce.com/initiatives/r/responsible-disclosure...](https://www.thegfce.com/initiatives/r/responsible-disclosure-initiative-ethical-hacking)

</comment><comment><USER81> Why did the author post in 2017, so long after? He said in early conversations he was going to go public much sooner.

<comment><USER23> He was afraid that he was bound by the NDA not to disclose it.

Now, in 2017, he flouts the NDA and acts in the public interest.

<comment><USER66> But why now? What changed?

<comment><USER84> Perhaps author gained some age and wits.

</comment></comment></comment></comment><comment><USER85> Surely one acquisition and 9 years later this isn't still an open vulnerability… right? It'd be nice if the author discussed that.

<comment><USER17> I have closed my account and do not know the answer. Also, please if someone would be able to confirm in the affirmative in this or any other Penson site, then please start a new round of responsible disclosure.

</comment></comment><comment><USER86> > October 2008

This may be a lot of it. In October 2008, a massive security breach affecting all accounts was maybe a solid #2 on their list of problems.

<comment><USER17> Very nice LOL here.

</comment></comment><comment><USER87> Palo Alto's school district just got hit by similar.

[https://www.paloaltoonline.com/news/2017/04/20/pausd- student...](https://www.paloaltoonline.com/news/2017/04/20/pausd-student-data- exposed-in-data-breach)

</comment><comment><USER88> I think that an important point in this vulnerability is that it does not violate the CFAA. From my, albeit limited, understanding of the CFAA, it requires access breach.

Imagine this conversation were the user to have discovered a parameter which let the user execute trades on behalf of another user.

<comment><USER71> This vulnerability does allow to execute trades on behalf of another user.

For example, a realistic exploit would be to slowly buy up a bunch of a random penny stock; and then post an image link to some forum frequented by users of that software with the order "buy 10000 units of stock_x, okthxbye". The order will be executed by users viewing that forum and will bump up the price as you dump it.

</comment></comment><comment><USER89> > What Happens When You Send a Zero-Day to a Bank?

The police rappel down the sides of your house in full gear and shoot your dog.

Or, per the article, the company pressures you to sign an NDA, and mentions "FBI" to instill fear of rappelling.

</comment><comment><USER90> I recently dropped a credit union because they can't be bothered to secure their mobile app (in the official google play store!) to use anything better than TLS1.0.

TLS1.2 and proper crypto schemes should be mandatory at this point.

<comment><USER91> They were going to be required by 2016, but then PCI-DSS decided to give companies an extra 2 years to implement the changes.

[https://cdn2.hubspot.net/hubfs/281302/Resources/Migrating_fr...](https://cdn2.hubspot.net/hubfs/281302/Resources/Migrating_from_SSL_and_Early_TLS_-v12.pdf)

</comment></comment><comment><USER92> Mudge at DefCon IIRC had a good point about MIC contractors having Intellectual Property repeatedly stolen, govt gives more money each time and disincentives to root-cause analysis and patching vulns/0days.

</comment><comment><USER93> Were cookies shared across sites in 2008? It seems pretty odd..

<comment><USER94> Images are loaded with the cookies of their own site. Example: go to google.com, then open the console and type the following:

var i = document.createElement('img');

i.src= "[http://news.ycombinator.com/y18.gif";](http://news.ycombinator.com/y18.gif";)

Then look at the cookies sent over the network.

<comment><USER95> This is how FB & others track everyone on the web through ad frames, like buttons, etc.

<comment><USER96> Do they get info about from which page they got requested when one includes just an image?

<comment><USER97> Yes, it is passed along through the Referer (sic) header.

</comment></comment></comment></comment></comment><comment><USER98> With some hindsight perhaps the Term of the NDA could have been improved by adding 'until ten years have passed'

Is that a common element of an NDA's term?

</comment><comment><USER99> When you submit a zero day to a bank, maybe let us know. I this case, you submitted a zero-day to a trader-broker, not a bank.

</comment><comment><USER100> Or they call the FBI and bust your ass and you have to file bankruptcy and get probation.

</comment><comment><USER101> What bank or financial firm has 100k branches? That's a HUGE presence.

<comment><USER17> Penson created the system that multiple brokers use for multiple branches.

I cannot verify that number but I am quoting it from a phone call with a Penson engineer.

</comment></comment><comment><USER102> Hasn't this guy ever heard of CERT?

</comment><comment><USER103> Balls. Made of steel.

</comment><comment><USER104> Well, good luck.

</comment><comment><USER105> _What about XFRS, CORS protection, …? This was 2008. We still had the <blink> tag back then._

Heh.</comment>


American Loneliness - <AUTHOR> https://lareviewofbooks.org/essay/american-loneliness?src=longreads

<comment><USER2> Just before the article turns to the television show, the author points out that "every piece of art I've ever loved is about the loneliness of other generations."

Does anyone know where i could find significant pieces dedicated to loneliness in different eras in history? I also find the topic fascinating, and would like to see how technology has changed the art in form and subject.

<comment><USER3> Well, some classic "high school English literature class" books that fulfill that criteria are Miller's _Death of a Salesman_ and Wharton's _Ethan Frome._

Still in the Western classical canon, Puccini's _Madame Butterfly_ is fantastic, if you're into opera.

</comment></comment><comment><USER4> I never caught the TV show but the film was fun if not a little hard to buy because it was so over the top. I think probably the success of the show can be helped mostly on the high profile catfish of star college football player Mante Te'o. A very large audience had been first enthralled by the idea of his cancer stricken girlfriend that he was playing for. But then that same audience learned both the phrase "catfish" and the hard truth that he had been duped because that girlfriend didn't exist.[0] It was national news for awhile and broke thanks to research from Deadspin. How ABC and other outlets (ESPN,CBS,Sports Illustrated,NYPOST) didn't look up if the girl had existed before they spoke about it still blows me away.

[0] [http://deadspin.com/manti-teos-dead-girlfriend-the-most- hear...](http://deadspin.com/manti-teos-dead-girlfriend-the-most- heartbreaking-an-5976517)

<comment><USER5> > the film was fun if not a little hard to buy because it was so over the top.

But people who fake cancer to gain friends are over the top.

Ten Year Cancer Hoax: [http://gawker.com/5914621/the-long-fake-life-of-js- dirr-a-de...](http://gawker.com/5914621/the-long-fake-life-of-js-dirr-a- decade%20long-internet-cancer-hoax-unravels)

A cancer patient who is befriended by fake cancer patients, not once, not twice, but thrice: [http://www.thestranger.com/seattle/the-lying- disease/Content...](http://www.thestranger.com/seattle/the-lying- disease/Content?oid=15337239)

Here's a fake cancer sufferer created by a child and her friends, but abandoned by them, and then taken over by the mother:

Guardian UK newspaper report: [http://www.guardian.co.uk/technology/2001/may/28/internetnew...](http://www.guardian.co.uk/technology/2001/may/28/internetnews.mondaymediasection)

Wikipedia Entry [https://en.wikipedia.org/wiki/Kaycee_Nicole_Swenson](https://en.wikipedia.org/wiki/Kaycee_Nicole_Swenson)

The FAQ [http://web.archive.org/web/20050115092141/http://www.rootnod...](http://web.archive.org/web/20050115092141/http://www.rootnode.org/article.php?sid=26) on the wayback machine

The metafilter investigation [http://www.metafilter.com/7878/The-Kaycee- Nicole-Swensen-Faq](http://www.metafilter.com/7878/The-Kaycee-Nicole-Swensen- Faq)

Deconstructing Kaycee [http://psychcentral.com/blogs/kaycee.htm](http://psychcentral.com/blogs/kaycee.htm)

</comment></comment><comment><USER6> Am I missing something? This is just a review of some MTV reality TV show. Why is this article interesting to anyone (least of all Hacker News readers)?</comment>


Twitter consistently centers image previews on whiter faces - <AUTHOR> https://twitter.com/bascule/status/1307440596668182528 <comment><USER2> Perfect example of how not proactively making an algorithm anti-racist can yield results that end up being racist. If you train a machine learning algorithm on photos with predominantly white faces, your algorithm is going to think people with lighter skin are more important thank people with darker skin.

<comment><USER3> Why are people downvoting this? The parent is correct. If you don't test your models adequately then they'll have holes like this one.

<comment><USER2> HN doesn't like talking about race or numerous other "controversial" topics. This story is already flagged off the front page.

<comment><USER4> > HN doesn't like talking about race or numerous other "controversial" topics.

There was plenty of discussions on HN when GitHub was renaming master/slave terminology [0] and when other open source projects were doing the same. Essentially they break the HN guidelines when they 'like' if it is a company / person they 'like'.

On the other hand, when a topic attacks their 'narrative' or attacks their side of the argument from someone they don't like, they downvote, flag and censor and make sure it is never seen. Even if it is factual and has evidence.

[0] [https://news.ycombinator.com/item?id=23518123](https://news.ycombinator.com/item?id=23518123)

</comment></comment></comment></comment><comment><USER5> In case anyone else did not realize this and is as confused as I was, apparently you can attach more than one photo to a tweet, and Twitter will then show previews of all of them in a gallery. The previews are formed by taking some part of the original image. Clicking on any of the previews opens a view of the corresponding full image.

I knew about twitter taking a part of an image and using that for a preview, but had not realized that there could be more than one image in a tweet.

</comment><comment><USER6> Why is this flagged?

</comment><comment><USER7> Wow.

(nothing else to say)

</comment><comment><USER8> Consistent in the title is misleading because this is essentially n=1. The Twitter user did try to transform the image in order to produce a different result but we don't know if there is something not race based in Mitch's face that the algorithm prefer's over Obama's. We also don't know if the user has cherry picked this example.</comment>